πŸ›‘ Cybersecurity & Privacy πŸ›‘ - News
25.8K subscribers
89.2K links
πŸ—ž The finest daily news on cybersecurity and privacy.

πŸ”” Daily releases.

πŸ’» Is your online life secure?

πŸ“© lalilolalo.dev@gmail.com
Download Telegram
⚠ β€œFace of Anonymous” suspect deported from Mexico to face US hacking charges ⚠

After nearly a decade as a US expat dubbed "The Face of Anoynmous", he's back in the US facing cybercrime charges from almost a decade ago.

πŸ“– Read

via "Naked Security".
❌ Microsoft Gets Second Shot at Banning hiQ from Scraping LinkedIn User Data ❌

Decision throws out previous ruling in favor of hiQ Labs that prevented Microsoft’s business networking platform to forbid the company from harvesting public info from user profiles.

πŸ“– Read

via "Threat Post".
🦿 Microsoft product vulnerabilities reached a new high of 1,268 in 2020 🦿

56% of all Microsoft critical vulnerabilities could have been mitigated by removing admin rights, according to the 2021 BeyondTrust Microsoft Vulnerabilities Report.

πŸ“– Read

via "Tech Republic".
πŸ•΄ How Does the Government Buy Its Cybersecurity? πŸ•΄

The federal government is emphasizing cybersecurity regulation, education, and defense strategies this year.

πŸ“– Read

via "Dark Reading".
❌ SASE & Zero Trust: The Dream Team ❌

Forcepoint’s Nico Fischbach, global CTO and VPE of SASE, and Chase Cunningham, chief strategy officer at Ericom Software, on using SASE to make Zero Trust real.

πŸ“– Read

via "Threat Post".
πŸ›  Hashcat Advanced Password Recovery 6.2.2 Source Code πŸ› 

Hashcat is an advanced GPU hash cracking utility that includes the World's fastest md5crypt, phpass, mscash2 and WPA / WPA2 cracker. It also has the first and only GPGPU-based rule engine, focuses on highly iterated modern hashes, single dictionary-based attacks, and more. This is the source code release.

πŸ“– Read

via "Packet Storm Security".
πŸ•΄ How President Biden Can Better Defend the US From Russian Hacks πŸ•΄

Wilson Center cybersecurity expert Meg King pinpoints five ambitious steps the administration should take, including a comprehensive national data breach notification protocol.

πŸ“– Read

via "Dark Reading".
❌ Microsoft Disrupts Large-Scale, Cloud-Based BEC Campaign ❌

Varied cloud infrastructure was used to phish email credentials, monitor for and forward finance-related messages and automate operations.

πŸ“– Read

via "Threat Post".
❌ Malicious PDFs Flood the Web, Lead to Password-Snarfing ❌

SolarMarker makers are using SEO poisoning, stuffing thousands of PDFs with tens of thousands of pages full of SEO keywords & links to redirect to the malware.

πŸ“– Read

via "Threat Post".
πŸ•΄ What Industrial Control System Vulnerabilities Can Teach Us About Protecting the Supply Chain πŸ•΄

Older technologies used in industrial and critical infrastructure leave the sector highly vulnerable to attack, but organizations can take steps to better protect themselves.

πŸ“– Read

via "Dark Reading".
πŸ•΄ Deloitte Buys Terbium Labs to Expand Threat Intel Capabilities πŸ•΄

Terbium Labs' products and services will become part of Deloitte's Detect & Respond lineup, the company confirms.

πŸ“– Read

via "Dark Reading".
β€Ό CVE-2021-31497 β€Ό

This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of DWG files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-13311.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-31487 β€Ό

This vulnerability allows remote attackers to execute arbitrary code on affected installations of OpenText Brava! Desktop 16.6.3.84. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DWF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-12715.

πŸ“– Read

via "National Vulnerability Database".
πŸ•΄ Andariel Group Targets South Korean Entities in New Campaign πŸ•΄

Andariel, designated as a sub-group of the Lazarus Group APT, has historically targeted South Korean organzations.

πŸ“– Read

via "Dark Reading".
❌ Millions of Connected Cameras Open to Eavesdropping ❌

A supply-chain component lays open camera feeds to remote attackers thanks to a critical security vulnerability.

πŸ“– Read

via "Threat Post".
πŸ•΄ Security Experts Scrutinize Apple, Amazon IoT Networks πŸ•΄

Both companies have done their due diligence in creating connected-device networks, but the pervasiveness of the devices worries some security researchers.

πŸ“– Read

via "Dark Reading".
πŸ•΄ Microsoft Disrupts Large-Scale BEC Campaign Across Web Services πŸ•΄

Attackers had used the cloud-based infrastructure to target mailboxes and add forwarding rules to learn about financial transactions.

πŸ“– Read

via "Dark Reading".
πŸ•΄ Thousands of VMware vCenter Servers Remain Open to Attack Over the Internet πŸ•΄

Three weeks after company disclosed two critical vulnerabilities in the workload management utility, many organizations have not patched the technology yet, security vendor says.

πŸ“– Read

via "Dark Reading".
β€Ό CVE-2021-34170 β€Ό

Bandai Namco FromSoftware Dark Souls III allows remote attackers to execute arbitrary code.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2020-21316 β€Ό

A Cross-site scripting (XSS) vulnerability exists in the comment section in ZrLog 2.1.3, which allows remote attackers to inject arbitrary web script and stolen administrator cookies via the nickname parameter and gain access to the admin panel.

πŸ“– Read

via "National Vulnerability Database".
β€Ό CVE-2021-30550 β€Ό

Use after free in Accessibility in Google Chrome prior to 91.0.4472.101 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.

πŸ“– Read

via "National Vulnerability Database".